Back in April of
this year Microsoft announced the rollout of a new Viewer role in Power BI
workspaces. It is mentioned in the release notes of April of this year: Power BI Planned features
This is all part of
the newworkspace experience, which in fact is not that new anymore :) It in fact
has become the default workspace you create, there will be a plan to migrate
old workspaces to the new ones. You can read the docs on howthe new workspaces are different or on workspacefeatures that work differently.
As of now we have 4
roles available in a Power BI workspace. The new Viewer role works quite the
same as the classic workspace option "Members can only view Power BI
content". It gives a read-only experience to the users.
A few remarks that
weren't totally clear for me in the beginning:
- You can have read-only access to the content in the workspace without publishing an app.
- The Viewer role does requires a Pro license or your content must reside in Power BI Premium capacity. That way it behaves the same as the published app on a workspace in Premium capacity.
- Row-level security (RLS) on the datasets in the Power BI workspace is enforced for users who only have the Viewer role.
- Users can only export summarized data.
- If you want a user with a Viewer role to Analyze in Excel, they need Build permissions on that dataset.
- Build permission on a dataset also means they can export the underlying data that's used to build the visual, so you might be careful before granting that access, especially with RLS.
There was an
improvement to the export of summarized data with the Build permission. If
you're using that or are planning to give users the Build permission, please do
read the following blog post by Lukasz Pawlowski: Change to Summarized Data Export behavior with Build permission.
Here is an overview
of the capabilities of the four roles: admins, members, contributors, and
viewers:
So let's take a look
at the experience in the Power BI Service. I tested everything myself to be
sure, so these are all pictures from our own tenant.
When granting access
to a user you can choose from one of the 4 roles:
In the new
workspace you can choose to add individual users or add security group, where
the latter is the best practice. That way you can manage the users and their
access outside of Power BI.
As a Viewer,
you only see the Dashboards, Reports and workbooks, in either view of the
workspace. So the Datasets and Dataflows are not visible.
This is the
File menu when logged in as a Viewer. So you can't download the pbix-file, as
that would give you access to the underlying data.
This is the
top level content of the workspace when logged in with the Viewer role.
As an Admin
in the same workspace, you not only see the Datasets and Dataflows, you also
have a lot more options like Usage Metrics, Settings, Delete, etc.
In a next
blog post I will show how the Row-Level Security works together with the Viewer
role and the Build permission on a dataset.
I hope this
makes it a clear overview of the capabilities of the new Viewer role. If you
have any other use cases or anything to add please let me know in the comments!